使用Python上传文件至Supabase Storage触发RLS策略违规403错误排查

问题描述 #

使用Python将JPG文件上传至Supabase Storage时，返回403错误：

b'{"statusCode":"403","error":"Unauthorized","message":"new row violates row-level security policy"}'

已配置RLS策略并为Storage分配上传权限，上传代码如下：

file_path = r"C:\supabase projects\supabase auth 24-01-2024\uploads\test.jpg"
file_name = "test.jpg"  
path_on_supastorage = "uploaded_files/test.jpg"
content_type = "image/jpg"

with open(file_path, 'rb') as file:
     response = supabase.storage.from_(bucket_name).upload(
                                                      file=file,
                                                      path=path_on_supastorage)

     # Check for successful upload
     if response is not None:
         print(f"Failed to upload file: {response.content}")
     else:
         print(f"File uploaded successfully: {response}")

可能的原因 #

• storage.objects表RLS策略缺失：Supabase Storage的上传操作会向storage.objects表插入记录，仅配置bucket权限不够，需为该表添加允许插入的RLS策略。比如针对认证用户的策略：CREATE POLICY "Allow authenticated users to upload files" ON storage.objects FOR INSERT TO authenticated WITH CHECK (auth.uid() IS NOT NULL);
• 未完成用户认证：若Supabase客户端未执行用户登录操作（如supabase.auth.sign_in_with_password()），上传请求以匿名身份发送。如果RLS策略要求必须认证，就会触发拒绝。
• 路径不匹配策略规则：若RLS策略对文件路径有前缀限制（仅允许上传到特定目录），而代码中path_on_supastorage的路径不符合规则，会被策略拦截。
• 策略条件逻辑错误：检查策略的条件表达式，比如路径匹配是否用对了LIKE（前缀匹配需用path LIKE 'uploaded_files/%'），或者字段名是否正确（如混淆path和name）。
• Bucket访问级别与策略不匹配：若Bucket设为私有，但RLS策略未允许当前用户访问该Bucket的对象，也会导致权限拒绝。

内容的提问来源于stack exchange，提问作者Priyanka Changediya